ImageFolio All Versions : admin.cgi Directory transversal and file delete exploit.

["Paul Craig" <pimp () brainwave net nz>]

    /----------------------------
            Pimp industries. 
    -----------------------------/
            
 ImageFolio All Versions  : admin.cgi Directory transversal and file
delete exploit.
 Company: www.imagefolio.com
 
Background
-------------
ImageFolio is a multi-platform, server-based, software product suite
that fully automates the process of viewing, publishing, maintaining,
distributing, archiving, and marketing your Web-based multimedia gallery
or store. ImageFolio supports all media types, including images, video,
and sound. 
 
 
Exploit:
-------------
 
The exploit occurs inside admin.cgi found usually in
/cgi-bin/ImageFolio/admin/admin.cgi.
Once the admin has logged in you can use the remove function to delete
media, however no checking for
../ is done so it is very easy to simply traverse back through the file
system.
This not only allows you to list the contents of files in directories
but also remove any file as the user the web server is running as.
Usually this would be limited by the fact you have to be authenticated
as an Admin user, but since the default username/password of
Admin/ImageFolio exists on a lot of servers in the wild (default
account).Tisk Tisk.
Always change the default username/password!
 
 
Example
 
 
http://www.samplesite.com/cgi-bin/imagefolio/admin/admin.cgi?cgi=remove.
pl&uid=111.111.111.111&rmstep=2&category=../../../../../../../../../../.
./etc/
 
 
Suggestions/Work Around:
-------------
BizDesign were contacted and have issued a fix that can be found at
http://www.imagefolio.com/ubb/Forum25/HTML/000019.html
I would like to thank BizDesign for being so prompt on fixing this flaw.
 
 
Greets
-------------
archive, decx, Mark Burnett, *.nz and anyone with more than two brain
cells..
Oh and most of all you.
 
 
 
 
 
Paul Craig
Security Researcher
Pimp Industries
 
"He who laughs last thinks slowest!"